Security management

Security management is a continuous cycle, not a document

This section demonstrates how the work is actually structured: understand the context, assess the threat, assess the risk to people and programmes, select controls, monitor for change, manage incidents, review honestly and reissue the assessment.

Illustrative analytical example — demonstrates method, not operational guidance for a specific organisation.

The cycle

Each stage asks a question and produces something a manager can act on. The cycle closes: the review feeds the next assessment.

01
Context analysis
Where are we working, with whom, and who holds influence?
Context statement, actor map, stakeholder and acceptance position.
02
Threat assessment
Who or what could cause harm, with what intent and capability?
Threat list with UK threat level and reasoning for each.
03
Risk assessment
How exposed and vulnerable are our people, assets and programmes?
Risk register with likelihood, impact and residual risk.
04
Mitigation
Which controls reduce likelihood or impact, and who owns them?
Control set, movement rules, thresholds, named risk owners.
05
Monitoring
What would tell us the environment is changing?
Indicator set with review triggers and reporting rhythm.
06
Incident management
What happens in the first hour, and who decides?
Escalation ladder, contact tree, decision log, action cards.
07
Review
What did the incident or trend teach us?
After-action review, corrected assumptions, revised controls.
08
Updated risk assessment
Does the register still reflect reality?
Reissued assessment with dated change history.